AWS securityhub high security documentation change

Service: securityhub · 2026-04-04 · Security-related high

File: securityhub/latest/userguide/exposure-rds.md

Summary

Added new section documenting exposure finding for publicly shared Amazon RDS snapshots with remediation guidance

Security assessment

This change explicitly documents a security vulnerability where RDS snapshots are publicly shared, which can lead to data breaches and unauthorized data access. The documentation warns that 'any AWS account has permission to copy these public snapshots and create DB instances from them, which could lead to data breaches or unauthorized data access' - this is concrete evidence of addressing a specific security exposure.

Diff

diff --git a/securityhub/latest/userguide/exposure-rds.md b/securityhub/latest/userguide/exposure-rds.md
index 694d8a33e..849ee2391 100644
--- a//securityhub/latest/userguide/exposure-rds.md
+++ b//securityhub/latest/userguide/exposure-rds.md
@@ -28,0 +29,2 @@ The remediation guidance provided in this topic might require additional consult
+    * [The Amazon RDS DB instance has a snapshot that's shared publicly](./exposure-rds.html#publicly-available-rds-database-snapshot)
+
@@ -78,0 +81,8 @@ In the exposure finding, open the resource through the hyperlink. For informatio
+### The Amazon RDS DB instance has a snapshot that's shared publicly
+
+Public snapshots can be accessed by any AWS account, potentially exposing sensitive data to unauthorized users. Any AWS account has permission to copy these public snapshots and create DB instances from them, which could lead to data breaches or unauthorized data access. Following security best practices, we recommend restricting access to your Amazon RDS snapshots to only trusted AWS accounts and organizations. 
+
+###### Configure an Amazon RDS snapshot for private access
+
+In the exposure finding, open the resource through the hyperlink. For information about how to modify snapshot sharing settings, see [Sharing a DB snapshot](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.html) in the _Amazon RDS User Guide._ For information about how to stop sharing snapshots, see [Stop sharing a DB snapshot](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.html#USER_ShareSnapshot.Sharing.StopSharing) in the _Amazon RDS User Guide._. 
+